Leak at LDLC

On 10 December 2024, LDLC — a leading French online retailer of computer hardware and high-tech products — disclosed that it had suffered a cyberattack resulting in the theft of customer data. It was the second major breach to hit the Lyon-based group in 2024, and unlike the earlier incident (which affected roughly 1.5 million physical-store customers in early 2024), this one reportedly touched LDLC's entire customer base, both web and in-store, potentially exposing several million people.

In its statement, LDLC said an unauthorized intrusion into its systems had led to the exfiltration of personal customer data. The company emphasized that no financial information or sensitive data was affected. The precise attack vector was not disclosed, and the full scope was still being investigated at the time of the announcement.

Based on the company statement and press reporting, the exposed data was limited to contact and identity information:

• Names
• Email addresses
• Phone numbers

LDLC said it immediately mobilized security experts and partners to reinforce its existing protective measures, notified the relevant government authorities and the data-protection regulator (CNIL) under GDPR, and committed to informing affected customers directly once the analysis concluded. As of the disclosure, the investigation was ongoing.